e98ef858f5c1a52f30f8dabe40532647f33bd218eefa8a145b1f4b25a7bb33ad

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 04:12

Target

5a3f516e0f144f00f0552f32cf0a53b7.dll
Size

78KB
MD5

5a3f516e0f144f00f0552f32cf0a53b7
SHA1

855f39db2f500e3203548153e5f424c669432d5c
SHA256

e98ef858f5c1a52f30f8dabe40532647f33bd218eefa8a145b1f4b25a7bb33ad
SHA512

2b024215fd86f7b22f3c16066fa5ef8096036292a8e1898dc5965722fb0551c4be16fb884601569d636161dd81591d22db7dff71d5ad868fcaa9998d922ab2c0
SSDEEP

1536:X3D7pM3Arx3YpSfwWxUo64oqEGAP28YOXatzj3j+69h1YezLUE:X3Ddmmx3YpSIWx5+JXu8YOO66xY4LZ

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a3f516e0f144f00f0552f32cf0a53b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a3f516e0f144f00f0552f32cf0a53b7.dll,#1
  2⤵
  PID:2680